← VCE Data Analytics U4O2

Data loss prevention controls

Controls that detect and block sensitive data leaving an organisation, such as by email, USB or upload, and alert staff to risky transfers like large exports.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 58

Understanding Data loss prevention controls in VCE Data Analytics U4O2

What it does: Blocking writes to removable drives is a USB restriction that prevents sensitive data leaving on a flash drive. The condition detects sensitive content in an upload and the action blocks it, showing detect and block. DLP focuses on data leaving the organisation (by email, USB or upload). Controls such as account lockouts deal with password guessing. DLP checks the content of outgoing data, not just who sends it. Sensitive files are blocked and staff are alerted. Alerts on large exports help staff spot risky transfers early, such as an insider copying a whole database. DLP blocks sensitive transfers whether the cause is a malicious insider, an attacker or an honest mistake.

Common mistakes: This DLP rule is meant to stop sensitive data being copied to a USB drive. Opening a file is not a USB transfer, so the first line should check for action = USB_COPY. An alert about a large export should go to the security team, who can review the risky transfer. It should not go only to the person doing the export. The line should be SEND alert TO security_team.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Data loss prevention controls to a class →

This module's key terms are also in a printable crossword (Modules 44–79) and word search (Modules 44–113).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What is the main job of a data loss prevention (DLP) control?
Stop outsiders from guessing user passwordsDetect and block sensitive data from leaving the organisation
Matches
DLP rule: allow all USB copying but log nothing
↓
This does not restrict USB use or detect transfers, so sensitive data can leave unnoticed. DLP should block or limit USB copying and record or alert on it.
Applying
Meanings
Term
Data loss prevention (DLP)
Meaning
Controls that detect and block sensitive data leaving an organisation, such as by email, USB or upload, and alert staff to risky transfers like large exports.
Practice
IF file is sensitive AND channel is email THEN
Testing
Gaps
emailsend
Check Answer
Spots
1IF action = OPEN_FILE
2AND label = SENSITIVE

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Narwhal' badge — Unicorn Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What is the main job of a data loss prevention (DLP) control?
A. Stop outsiders from guessing user passwords
B. Detect and block sensitive data from leaving the organisation ✓
DLP focuses on data leaving the organisation (by email, USB or upload). Controls such as account lockouts deal with password guessing.
2. A DLP tool scans an outgoing email and finds an attached file full of customer credit card numbers. What should it do?
A. Block the email and alert security staff ✓
B. Let the email through because it is from a staff member
DLP checks the content of outgoing data, not just who sends it. Sensitive files are blocked and staff are alerted.
3. Which USB restriction is an example of a DLP control?
A. Blocking copying of sensitive files to unapproved USB drives ✓
B. Installing a larger hard drive in each computer
USB restrictions stop sensitive data being copied onto removable devices that could leave the organisation.
4. An employee exports 50,000 customer records in one go. What would a DLP control most likely do?
A. Raise an alert about the unusually large export ✓
B. Ignore it, because size does not matter
Alerts on large exports help staff spot risky transfers early, such as an insider copying a whole database.
5. Which channel can DLP controls monitor to stop sensitive data leaving?
A. Only the colour of the login screen
B. Email, USB and file uploads ✓
DLP watches the paths data can leave through, including email, removable USB drives and uploads to websites or cloud storage.

Match the Pairs

DLP rule: block email if attachment contains tax file numbers → Stops a sensitive file transfer by scanning outgoing email for protected data and blocking it before it leaves
DLP rule: if export > 5000 rows then alert security team → Raises an alert when someone exports an unusually large amount of data so staff can review a risky transfer
DLP can restrict USB devices so sensitive files cannot be copied to removable storage → USB_policy = "block write to removable drives"
DLP detects sensitive data in an upload and blocks it from leaving the organisation → IF upload contains "CONFIDENTIAL" THEN block upload
DLP rule: allow all USB copying but log nothing → This does not restrict USB use or detect transfers, so sensitive data can leave unnoticed. DLP should block or limit USB copying and record or alert on it.
DLP rule: scan email only after it has been sent → Scanning after sending is too late because the sensitive data has already left. DLP must inspect and block the transfer before it leaves the organisation.

Key Term

Data loss prevention (DLP)
Controls that detect and block sensitive data leaving an organisation, such as by email, USB or upload, and alert staff to risky transfers like large exports.

Fill in the Blanks

1. IF file.label = "Confidential" THEN BLOCK email_send END IF
Hint: Type the DLP action that stops the sensitive file from being sent.
2. IF device.type = "USB" THEN BLOCK file_copy END IF
Hint: Type the property that tells the rule what kind of device is plugged in.
3. IF export.rows > 10000 THEN ALERT security_team END IF
Hint: Type the comparison operator that checks whether the export is larger than the limit.
4. IF export.rows > 10000 THEN ALERT security_team END IF
Hint: Type the action that notifies staff about a risky transfer.
5. IF file.sensitive AND upload.external THEN BLOCK upload END IF
Hint: Type the logical operator that needs both conditions to be true before the upload is blocked.

Spot the Error

Question 1
A IF action = OPEN_FILE
B AND label = SENSITIVE
C THEN BLOCK transfer
D LOG event
Line A — This DLP rule is meant to stop sensitive data being copied to a USB drive. Opening a file is not a USB transfer, so the first line should check for action = USB_COPY.
Question 2
A IF rows_exported > 5000
B HOLD export
C SEND alert TO export_user
D ENDIF
Line C — An alert about a large export should go to the security team, who can review the risky transfer. It should not go only to the person doing the export. The line should be SEND alert TO security_team.
Question 3
A IF channel = EMAIL
B AND attachment has card_number
C THEN ALLOW email
D NOTIFY sender
Line C — A DLP control must block an email that carries sensitive data such as card numbers. Allowing it defeats the purpose. The line should be THEN BLOCK email.
Question 4
A IF action = WEB_UPLOAD
B AND file.label = PUBLIC
C AND site NOT IN approved_list
D THEN BLOCK upload
Line B — The rule should block uploads of sensitive files to unapproved sites. Checking for PUBLIC files would block harmless uploads and let sensitive ones through. It should be AND file.label = SENSITIVE.
Question 5
A SET limit = 1000
B SET rows = COUNT(export_rows)
C IF rows > limit
D CLEAR alert
E ENDIF
Line D — When an export is larger than the limit, DLP should raise an alert so staff can check it. Clearing the alert hides the risky export. The line should be RAISE alert.

Student with a class code? Join your class →